CVE-2026-6942CWE-78

radare2-mcp <=1.6.0 OS Command Injection via Shell Metacharacter Bypass

Critical · published April 23, 2026

CVSS v4.0
9.3
EPSS
3%
Percentile
87.2
In the wild
Unconfirmed
What it is

radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metacharacters in user-controlled input passed to r2_cmd_str(). Attackers can inject shell metacharacters through the jsonrpc interface parameters to achieve remote code execution on the host running radare2-mcp without requiring authentication.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.02982 · 87.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-04-23T20:58Z
EPSS history
Timeline
  • 23 APR 20:58Z
    radare2-mcp <=1.6.0 OS Command Injection via Shell Metacharacter Bypass
    cvelistv5